HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 22, 2013.
- Organization as reported
- University of California, San Francisco, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop, Paper/Films
- Submission date
- Nov. 22, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15258, row:6397)
- Archived copy
- Held in the private archive (provenance)
On September 25, 2013, a personal laptop computer containing electronic protected health information (ePHI), and paper documents containing PHI, were stolen out of a physician’s locked car, affecting 8,294 individuals. The stolen laptop contained unencrypted ePHI, including patients’ names, addresses, social security numbers, dates of birth, diagnoses, conditions, lab results, medications, and other treatment related-ePHI. The covered entity (CE), University of California San Francisco, provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE updated its policy on safeguarding ePHI to specifically address personally owned electronic devices, including the requirement that they be encrypted, and that ePHI transported offsite must stay within the direct possession of the workforce member. OCR obtained written assurances that the CE implemented the corrective actions listed above.